cvelistv5 - cve-2025-34083

CVE-2025-34083 (GCVE-0-2025-34083)

Vulnerability from cvelistv5 – Published: 2025-07-09 00:50 – Updated: 2025-07-16 15:49

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it is a duplicate of CVE-2020-36849.

Replaced by CVE-2020-36849

Show details on NVD website

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2025-07-16T15:49:00.572Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it is a duplicate of CVE-2020-36849.\u003cbr\u003e"
            }
          ],
          "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it is a duplicate of CVE-2020-36849."
        }
      ],
      "replacedBy": [
        "CVE-2020-36849"
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-34083",
    "datePublished": "2025-07-09T00:50:19.933Z",
    "dateRejected": "2025-07-16T15:45:35.730Z",
    "dateReserved": "2025-04-15T19:15:22.551Z",
    "dateUpdated": "2025-07-16T15:49:00.572Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-34083\",\"sourceIdentifier\":\"disclosure@vulncheck.com\",\"published\":\"2025-07-09T01:15:49.937\",\"lastModified\":\"2025-07-16T16:15:25.960\",\"vulnStatus\":\"Rejected\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it is a duplicate of CVE-2020-36849.\"}],\"metrics\":{},\"references\":[]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"providerMetadata\": {\"orgId\": \"83251b91-4cc7-4094-a5c7-464a1b83ea10\", \"shortName\": \"VulnCheck\", \"dateUpdated\": \"2025-07-16T15:49:00.572Z\"}, \"rejectedReasons\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it is a duplicate of CVE-2020-36849.\u003cbr\u003e\"}], \"value\": \"This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it is a duplicate of CVE-2020-36849.\"}], \"replacedBy\": [\"CVE-2020-36849\"], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-34083\", \"assignerOrgId\": \"83251b91-4cc7-4094-a5c7-464a1b83ea10\", \"state\": \"REJECTED\", \"assignerShortName\": \"VulnCheck\", \"dateReserved\": \"2025-04-15T19:15:22.551Z\", \"datePublished\": \"2025-07-09T00:50:19.933Z\", \"dateUpdated\": \"2025-07-16T15:49:00.572Z\", \"dateRejected\": \"2025-07-16T15:45:35.730Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

GHSA-Q6Q7-289W-X495

Vulnerability from github – Published: 2025-07-09 03:30 – Updated: 2025-07-16 18:32

Details

An unrestricted file upload vulnerability exists in the WordPress AIT CSV Import/Export plugin ≤ 3.0.3. The plugin exposes an upload handler at upload-handler.php that allows arbitrary file upload via a multipart/form-data POST request. This endpoint does not enforce authentication or content-type validation, enabling attackers to upload malicious PHP code directly to the server. Although the upload may produce an error related to CSV parsing, the malicious file is still saved under wp-content/uploads/ and remains executable. Notably, the plugin does not need to be active for exploitation to succeed.

Severity ?

10.0 (Critical)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-34083"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-09T01:15:49Z",
    "severity": "CRITICAL"
  },
  "details": "An unrestricted file upload vulnerability exists in the WordPress AIT CSV Import/Export plugin \u2264 3.0.3. The plugin exposes an upload handler at upload-handler.php that allows arbitrary file upload via a multipart/form-data POST request. This endpoint does not enforce authentication or content-type validation, enabling attackers to upload malicious PHP code directly to the server. Although the upload may produce an error related to CSV parsing, the malicious file is still saved under wp-content/uploads/ and remains executable. Notably, the plugin does not need to be active for exploitation to succeed.",
  "id": "GHSA-q6q7-289w-x495",
  "modified": "2025-07-16T18:32:33Z",
  "published": "2025-07-09T03:30:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-34083"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/wp_ait_csv_rce.rb"
    },
    {
      "type": "WEB",
      "url": "https://packetstorm.news/files/id/160918"
    },
    {
      "type": "WEB",
      "url": "https://vulncheck.com/advisories/wordpress-ait-csv-import-export-plugin-rce"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/36e699a4-91f2-426d-ba14-26036fbfeaea"
    },
    {
      "type": "WEB",
      "url": "https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-ait-themes-csv-import-export-arbitrary-file-upload-3-0-3"
    },
    {
      "type": "WEB",
      "url": "https://www.ait-themes.club/csv-import-export-wordpress-plugin"
    },
    {
      "type": "WEB",
      "url": "https://www.fortiguard.com/encyclopedia/ips/49754"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ait-csv-import-export/ait-csv-importexport-303-arbitrary-file-upload"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

FKIE_CVE-2025-34083

Vulnerability from fkie_nvd - Published: 2025-07-09 01:15 - Updated: 2025-07-16 16:15

Severity ?

Summary

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it is a duplicate of CVE-2020-36849.

References

	URL	Tags

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it is a duplicate of CVE-2020-36849."
    }
  ],
  "id": "CVE-2025-34083",
  "lastModified": "2025-07-16T16:15:25.960",
  "metrics": {},
  "published": "2025-07-09T01:15:49.937",
  "references": [],
  "sourceIdentifier": "disclosure@vulncheck.com",
  "vulnStatus": "Rejected"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2025-34083 (GCVE-0-2025-34083)

GHSA-Q6Q7-289W-X495

FKIE_CVE-2025-34083

Tags

Sightings

Nomenclature